1

IDA startup signatures are sets of signatures used in FLIRT to detect what library is used in a static linked executable .
I am about to use these signatures to detect which library is used in an executable file .
I must use pattern files in IDA FLIAR in startup folder .
but i don't know it's format and what does each field mean (:?)
here are a few sample pattern :

1)8BFF558BECE8........E8........5DC3.............................. 00 0000 0011 :0000 s=A/- ^0006 ___security_init_cookie ^000B ___tmainCRTStartup
2)6A0C68........E8........8BF98BF28B5D0833C0408945E485F6750C3915.. 00 0000 00F6 :0000 o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@; :00E4@ $LN18 :00E3@ $LN25 :00D3@ $LN29 :00D3@ $LN17 ^0003 __sehtable$___DllMainCRTStartup ^0008 __SEH_prolog4 ^001F ___proc_attached ^0037 __pRawDllMain ^0055 __CRT_INIT@12 ^0068 _DllMain@12 ^00DD ___CppXcptFilter ^00F1 __SEH_epilog4 ......0F84C50000008365FC003BF0740583FE02752EA1........85C07408575653FFD08945E4837DE4000F8496000000575653E8........8945E485C00F8483000000575653E8........8945E483FE01752485C07520575053E8........576A0053E8........A1........85C07406576A0053FFD085F6740583FE037526575653E8........85C075032145E4837DE4007411A1........85C07408575653FFD08945E4C745FCFEFFFFFF8B45E4EB1D8B45EC8B088B095051E8........5959C38B65E8C745FCFEFFFFFF33C0E8........C3

i could 't find any relevant content on the internet. can any body help me about the format?
More about my need:
I want to find library functions in PE files (on my own program not by IDA) and ,as there are a huge amount of FLAIR pattern for all libraries , I cannot load them altogether because of memory and speed issues .
I have also read pat.txt in IDA FLAIR and i know the patterns format but startup signatures format is a bit different and has new parts so I want to know about these new parts like : o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@;

  • Are you just trying to apply the signatures, or do you have an actual need of understanding the signature file format? – Jason Geffner Mar 12 '14 at 13:31
  • I want to find library functions in executables (on my own program not by IDA) and ,as there are a huge amount of FLAIR pattern for all libraries , I cannot load them altogether because of memory and speed issues . – Farzan R Nobakht Mar 13 '14 at 9:15
  • 1
    So you're trying to write a program to consume and use IDA's FLIRT files, without using IDA at all? Why reinvent the wheel? Why not just let IDA do the work and then write a script to export the matches? – Jason Geffner Mar 13 '14 at 13:26
  • 1
    If you really want to go ahead with your work, take a look at plb.txt, specifically the documentation for the -l switch. It will tell you what you need to know about the startup line you posted above. – Chris Eagle Mar 14 '14 at 4:33
3

First, you should begin by reading through pat.txt which is included with the IDA flair utilities. It describes the format of .pat files.

Second it would be helpful if you can clarify what you are trying to do. What processor/file type are you working with? In many cases you do not need to directly manipulate .pat files at all since Hex-Rays provides tools to generate .pat files and .sig files from those .pat files.

Third, it is not clear exactly what type of signatures you are trying to work with and why. IDA "startup" signatures are a special form of signature used the when you first create a database for a new binary file. The purpose of startup signatures is to identify startup routines and the compiler used to create the binary. This may in turn trigger the loading of additional library signature files. Library signature files are the ones used to recognize the presence of library code that has been statically linked into a binary. Signatures are usually generated by parsing a copy of the static link libraries that were linked into the binary you are interested in. The most common case for needing to understand the .pat file format is when the parsers that Hex-Rays ships with flair are not capable of parsing the link libraries that you are trying to create patterns from.

This link may also be useful: Hex-Rays FLIRT

  • Thank you @chris-eagle , i have read the IDA FLIAR pat documentation . I am about to detect library functions in PE files , in order to remove them from file for some purpose in my own program so i think a don't have any thing to do with sig files . All I need is that how should I match these startup signatures . By the way I have edited my post and I hope it will make more clear . – Farzan R Nobakht Mar 13 '14 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.